Independent, vendor-neutral due diligence for your material service provider arrangements. CYBORIUM helps APRA-regulated banks, insurers and superannuation licensees evaluate, select and monitor third parties under a capped provider-funded fee model, disclosed on request, with no reseller margin.
The earlier CPS 230 determination commenced on 1 July 2025. APRA finalised targeted amendments on 30 April 2026, and the replacement standard incorporating those amendments commenced on 1 July 2026. The current standard includes limited contractual exemptions for specified non-traditional service-provider arrangements where the stated conditions are met. Other CPS 230 risk-management requirements continue to apply.
APRA’s current CPS 230 Operational Risk Management standard commenced on 1 July 2026, replacing the earlier determination that commenced on 1 July 2025. It sets out how in-scope APRA-regulated entities must manage operational risk, maintain business continuity, and oversee the management of service provider arrangements.
Under CPS 230, a material service provider is any third party your entity relies on to undertake a critical operation, or one that exposes it to material operational risk. For each of these arrangements the standard expects comprehensive due diligence before onboarding, ongoing monitoring, a maintained register, and credible contingency and exit plans. Good CPS 230 third-party risk management is now a board-level accountability, not a procurement afterthought.
CPS 230 consolidates and replaces the former CPS 231 (Outsourcing) and CPS 232 (Business Continuity Management). The practical challenge for most entities is evidence: demonstrating that a provider was selected and is monitored on a defensible, arm’s-length basis. That is exactly where an independent evaluator adds value. Read our deeper explainer on how CPS 230 and CPS 234 are reshaping vendor selection in Australia, or review our independent evaluation methodology.
Six obligations sit at the centre of the service provider management pillar. Each one needs evidence an auditor and APRA can follow.
Maintain a register of material service providers, provide it to APRA on request, and keep it current as arrangements change.
Comprehensive assessment before entering into, or materially changing, an arrangement, covering capability, resilience and risk.
Continuous oversight of performance, control effectiveness and risk profile across the life of each material arrangement.
Identify and manage over-reliance on single providers and the sub-contractors (fourth parties) sitting behind them.
Credible, tested plans to substitute or exit a provider without unacceptable disruption to critical operations.
Notify APRA of material arrangements and material risk events, under a service provider management policy approved by the board.
CPS 230 applies across the APRA-regulated population. If your organisation holds an APRA licence, the service provider obligations apply to your critical third parties.
The earlier CPS 230 determination commenced on 1 July 2025. APRA finalised targeted amendments on 30 April 2026, and the replacement standard incorporating those amendments commenced on 1 July 2026. The current standard includes limited contractual exemptions for specified non-traditional service-provider arrangements where the stated conditions are met. Other CPS 230 risk-management requirements continue to apply. Confirm your entity’s specific obligations with APRA guidance and your own advisers.
CYBORIUM is a vendor-neutral evaluator. CYBORIUM does not sell, deliver, operate or invoice technology. Your organisation contracts directly with the selected provider. That provider pays CYBORIUM a capped fee. The assessment records fit, risk and the arm’s-length evidence CPS 230 expects, with no reseller margin.
CYBORIUM provides independent sourcing and evaluation support. It does not provide legal or regulatory advice, and does not certify compliance. Your entity remains responsible for meeting its own CPS 230 obligations.
Four steps that turn CPS 230 obligations into repeatable, evidenced practice.
Map critical operations and set the criteria that make a provider “material” for your entity.
Assess capability, operational resilience, security and financial standing. Base the assessment on evidence.
Rank options against objective criteria, exposing concentration and fourth-party exposure.
You contract directly with the chosen provider, with a reassessment cadence to keep the register current.
The dimensions that determine whether a third party can be relied on for a critical operation.
Continuity capability, recovery objectives and the provider’s own dependency chain under stress.
Security posture and control maturity, aligned to APRA CPS 234 expectations for information assets.
Financial standing and going-concern signals that speak to a provider’s durability.
Single-supplier reliance and the sub-contractors sitting behind a material provider.
Offshoring, jurisdiction and data-location risk relevant to Australian regulated data.
How readily the provider can be replaced, and how clean an exit path would be.
You receive documented, arm’s-length evidence for every material service provider decision. The record is designed for review by a board, an auditor and APRA.
Start a CPS 230 conversationCPS 230 calls for demonstrable, objective judgement. CYBORIUM does not sell, deliver, operate or invoice technology. Your organisation contracts directly with the selected provider. That provider pays CYBORIUM a capped fee. Evaluation criteria, evidence and client-held decision rights are documented, and CYBORIUM earns no reseller margin. Explore our guided vendor evaluations or our framework for enterprise vendor selection.
Operating under the Security of Critical Infrastructure Act as well? The enhanced CIRMP Rules set separate supply chain obligations for critical infrastructure entities, with their own compliance dates. Our guide to vendor and supplier risk management covers the assessment work both regimes expect.
Talk to an independent evaluator about your material service provider arrangements. CYBORIUM does not sell or invoice technology, earns no reseller margin, and is paid a capped fee by the selected provider.
These public sources inform the guidance on this page. CYBORIUM is not a law firm or a regulator, so check current wording with the issuing body before relying on it.
Last updated: